Cybersecurity Act, Critical Entities Resilience Act formally adopted
Yesterday, the Dutch Senate passed the Cybersecurity Act (Cbw; the Dutch implementation of NIS2) and the Critical Entities Resilience Act (Wwke). This makes the enactment of both laws final. They will take effect on August 15, 2026, marking an important step in strengthening the digital resilience of organizations.
The new legislation introduces mandatory security measures, incident reporting, oversight by designated authorities, and a registration requirement. For organizations subject to the laws, this means they must strengthen, document, and demonstrate their digital and/or physical security processes.
As of August 15, organizations are required to register on the NCSC portal. Voluntary registration is already possible.
As for the Cbw, organizations can assess their requirements through the NCSC portal (Dutch). Organizations that fall under the regulations of the Wwke are already notified.
